The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill accepts a user-provided topic and directly interpolates it into the initialization prompts for sub-agents (philosophers). This creates a surface where malicious input could attempt to override the sub-agents' behavior.
Ingestion points: The <topic> argument and the AskUserQuestion tool are used to collect external input in SKILL.md.
Boundary markers: The Agent tool call prompt utilizes Markdown headers (e.g., # Identity, # Encounter Context) and a warning block (⚠️ TEAM PROTOCOL — NON-NEGOTIABLE RULES ⚠️) to isolate context, which reduces but does not eliminate injection risks.
Capability inventory: The orchestrator skill is granted broad permissions, including Bash, Write, Edit, and the ability to spawn sub-agents via Agent and TeamCreate tools.
Sanitization: The skill instructions direct the agent to validate that the topic is "concrete" and "grounded," but there is no explicit mention of technical sanitization, escaping, or filtering for injection patterns.
[COMMAND_EXECUTION]: The skill's configuration (allowed-tools) includes the Bash tool. Although the skill logic focuses on orchestration and file writing rather than direct shell operations, the availability of this tool in a context that processes user-influenced prompts increases the potential impact of successful prompt injection.

encounter